Threat Descriptions

Trojan:W32/DNSChanger

Classification

Category :

Malware

Type :

Trojan

Platform :

W32

Aliases :

Trojan:W32/DNSChanger

Summary

Trojan:W32/DNSChanger will change the infected system's Domain Name Server (DNS) settings in order to divert traffic to unsolicited, and potentially illegal sites.

Removal

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

  • Check for the latest database updates

    First check if your F-Secure security program is using the latest updates, then try scanning the file again.

  • Submit a sample

    After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

    Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.

  • Exclude a file from further scanning

    If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

    Note: You need administrative rights to change the settings.

Technical Details

Trojan:W32/DNSChanger is a family of malware used by an organized crime syndicate to perpetuate click-fraud, where user's browsing activity is quietly manipulated (such as redirecting a user who clicks on a legitimate link to an unsolicited site) so that the attackers can generate revenue from pay-per-click online advertising schemes.

The trojan is usually a small file (about 1.5 kilobytes) that is designed to change the 'NameServer' Registry key value to a custom IP address. This IP address is usually encrypted in the body of a trojan.

As a result of this change, a victim's computer will contact the newly assigned DNS server to resolve names of different webservers.

This malware is discussed further in the following Labs Weblog post:

Variant: Trojan.Win32.DNSChanger.al

Lately we got a few samples of this trojan that were named 'PayPal-2.5.200-MSWin32-x86-2005.exe'. This trojan was programmed to change the DNS server name of a victim's computer to 193.227.227.218 address.

The Registry key that is affected by this trojan is:

  • [HKLM\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces] "NameServer"

Other registry modifications made involve creating these keys:

  • HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{random} DhcpNameServer = 85.255.xx.xxx,85.255.xxx.xxx
  • HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{random} NameServer = 85.255.xxx.133,85.255.xxx.xxx
  • HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ DhcpNameServer = 85.255.xxx.xxx,85.255.xxx.xxx
  • HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ NameServer = 85.255.xxx.xxx,85.255.xxx.xxx